paranoid option to reduce session hijacking by enforcing an IP match on session valid...

diff --git a/include/auth.php b/include/auth.php
index d82bc84d18062e4a864219f3956fe8525497724c..dd4afac2392200c904dcfe345b94b3a1349e93ae 100644 (file)
--- a/include/auth.php
+++ b/include/auth.php
@@ -1,20 +1,29 @@
 <?php
 
+
+function nuke_session() {
+       unset($_SESSION['authenticated']);
+       unset($_SESSION['uid']);
+       unset($_SESSION['visitor_id']);
+       unset($_SESSION['administrator']);
+       unset($_SESSION['cid']);
+       unset($_SESSION['theme']);
+       unset($_SESSION['page_flags']);
+}
+
+
 // login/logout 
 
+
+
+
 if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-params'))) || ($_POST['auth-params'] !== 'login'))) {
 
        if(((x($_POST,'auth-params')) && ($_POST['auth-params'] === 'logout')) || ($a->module === 'logout')) {
        
                // process logout request
 
-               unset($_SESSION['authenticated']);
-               unset($_SESSION['uid']);
-               unset($_SESSION['visitor_id']);
-               unset($_SESSION['administrator']);
-               unset($_SESSION['cid']);
-               unset($_SESSION['theme']);
-               unset($_SESSION['page_flags']);
+               nuke_session();
                notice( t('Logged out.') . EOL);
                goaway($a->get_baseurl());
        }
@@ -23,13 +32,19 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
 
                // already logged in user returning
 
+               $check = get_config('system','paranoia');
+               // extra paranoia - if the IP changed, log them out
+               if($check && ($_SESSION['addr'] != $_SERVER['REMOTE_ADDR'])) {
+                       nuke_session();
+                       goaway($a->get_baseurl());
+               }
+
                $r = q("SELECT * FROM `user` WHERE `uid` = %d LIMIT 1",
                        intval($_SESSION['uid'])
                );
 
                if(! count($r)) {
-                       unset($_SESSION['authenticated']);
-                       unset($_SESSION['uid']);
+                       nuke_session();
                        goaway($a->get_baseurl());
                }
 
@@ -57,14 +72,7 @@ if((isset($_SESSION)) && (x($_SESSION,'authenticated')) && ((! (x($_POST,'auth-p
 else {
 
        if(isset($_SESSION)) {
-               unset($_SESSION['authenticated']);
-               unset($_SESSION['uid']);
-               unset($_SESSION['visitor_id']);
-               unset($_SESSION['administrator']);
-               unset($_SESSION['cid']);
-               unset($_SESSION['theme']);
-               unset($_SESSION['my_url']);
-               unset($_SESSION['page_flags']);
+               nuke_session();
        }
 
        if((x($_POST,'password')) && strlen($_POST['password']))
@@ -140,6 +148,7 @@ else {
                $_SESSION['authenticated'] = 1;
                $_SESSION['page_flags'] = $r[0]['page-flags'];
                $_SESSION['my_url'] = $a->get_baseurl() . '/profile/' . $r[0]['nickname'];
+               $_SESSION['addr'] = $_SERVER['REMOTE_ADDR'];
 
                notice( t("Welcome back ") . $r[0]['username'] . EOL);
                $a->user = $r[0];